(2024.12.01 and earlier) Invalid / bad cert error when connecting to VDI using a custom domain

## Bug description

When customers deploy the [External Resources recipe](https://docs.aws.amazon.com/res/latest/ug/create-external-resources.html) and RES with a custom portal domain name, CertificateRenewalNode fails to refresh the TLS certificate for VDI connection with the following error in `/var/log/user-data.log`:
```
{
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "Error finalizing order :: OCSP must-staple extension is no longer available: see https://letsencrypt.org/2024/12/05/ending-ocsp",
"status": 403
}
```

As a result, customers will encounter an error that states `net::ERR_CERT_DATE_INVALID` (Chrome) or `Error code: SSL_ERROR_BAD_CERT_DOMAIN` (FireFox) when connecting to their VDIs in the RES web portal.

## Affected versions

2024.12.01 and earlier

## Mitigation

1. Navigate to the EC2 console. If there is an instance named `CertificateRenewalNode-` , terminate the instance.
2. Navigate to the Lambda console. Open the source code of the Lambda function named `-CertificateRenewalLambda-`. Identify the line staring with `./acme.sh --issue --dns dns_aws --ocsp-must-staple --keylength 4096` and remove the `--ocsp-must-staple` argument.
3. Select Deploy and wait for the code change to take effect.
4. Manually trigger the Lambda function: Go to the Test tab and then select Test. No additional input is required. This should create a certificate EC2 instance that updates the Certificate and PrivateKey secrets in Secret Manager. The instance will be terminated automatically once the secrets are updated.
5. Terminate the existing dcv-gateway instance: `-vdc-gateway` and wait for the auto scaling group to automatically deploy a new one.

Start with the -CertificateRenewalLambda- source and the CertificateRenewalNode flow described in the issue; locate the command containing --ocsp-must-staple. Confirm the renewal no longer requests the retired OCSP-must-staple extension, then verify that the Certificate and PrivateKey secrets update and newly deployed VDI gateways serve valid certificates.

Written by the indexing model from the issue text.